@sidhujag/sysweb3-keyring 1.0.491

package/cjs/keyring-manager.js

@@ -0,0 +1,1687 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyringManager = void 0;
+const secp256k1_1 = __importDefault(require("@bitcoinerlab/secp256k1"));
+const sysweb3 = __importStar(require("@sidhujag/sysweb3-core"));
+const sysweb3_network_1 = require("@sidhujag/sysweb3-network");
+const bip32_1 = require("bip32");
+const bip39_1 = require("bip39");
+const bip84_1 = __importDefault(require("bip84"));
+const bjs = __importStar(require("bitcoinjs-lib"));
+const bs58check_1 = __importDefault(require("bs58check"));
+const crypto_1 = __importDefault(require("crypto"));
+const crypto_js_1 = __importDefault(require("crypto-js"));
+const ethers_1 = require("ethers");
+const mapValues_1 = __importDefault(require("lodash/mapValues"));
+const omit_1 = __importDefault(require("lodash/omit"));
+const syscoinjs = __importStar(require("syscoinjs-lib"));
+const initial_state_1 = require("./initial-state");
+const ledger_1 = require("./ledger");
+const signers_1 = require("./signers");
+const storage_1 = require("./storage");
+const transactions_1 = require("./transactions");
+const trezor_1 = require("./trezor");
+const types_1 = require("./types");
+const derivation_paths_1 = require("./utils/derivation-paths");
+// Dynamic ETH HD path generation - will be computed as needed
+/**
+ * Secure Buffer implementation for sensitive data
+ * Provides explicit memory clearing capability
+ */
+class SecureBuffer {
+    constructor(data) {
+        this._isCleared = false;
+        if (typeof data === 'string') {
+            this.buffer = Buffer.from(data, 'utf8');
+        }
+        else {
+            this.buffer = Buffer.from(data);
+        }
+    }
+    get() {
+        if (this._isCleared || !this.buffer) {
+            throw new Error('SecureBuffer has been cleared');
+        }
+        return Buffer.from(this.buffer); // Return copy
+    }
+    toString() {
+        if (this._isCleared || !this.buffer) {
+            throw new Error('SecureBuffer has been cleared');
+        }
+        return this.buffer.toString('utf8');
+    }
+    clear() {
+        if (!this._isCleared && this.buffer) {
+            // Overwrite with random data first
+            crypto_1.default.randomFillSync(this.buffer);
+            // Then fill with zeros
+            this.buffer.fill(0);
+            this.buffer = null;
+            this._isCleared = true;
+        }
+    }
+    isCleared() {
+        return this._isCleared;
+    }
+}
+class KeyringManager {
+    constructor() {
+        // Store getter function for accessing Redux state
+        this.getVaultState = null;
+        // Method to inject store getter from Pali side
+        this.setVaultStateGetter = (getter) => {
+            this.getVaultState = getter;
+        };
+        // Helper method to get current vault state
+        this.getVault = () => {
+            if (!this.getVaultState) {
+                throw new Error('Vault state getter not configured. Call setVaultStateGetter() first.');
+            }
+            const vault = this.getVaultState();
+            // DEFENSIVE CHECK: Ensure vault state is properly structured
+            if (!vault) {
+                throw new Error('Vault state is undefined. Ensure Redux store is properly initialized with vault state.');
+            }
+            if (!vault.activeNetwork) {
+                throw new Error('Vault state is missing activeNetwork. Ensure vault state is properly initialized before keyring operations.');
+            }
+            if (!vault.activeAccount) {
+                throw new Error('Vault state is missing activeAccount. Ensure vault state is properly initialized before keyring operations.');
+            }
+            return vault;
+        };
+        // Helper to get active chain from vault state (replaces this.activeChain)
+        this.getActiveChain = () => {
+            return this.getVault().activeNetwork.kind;
+        };
+        // Secure session data - using Buffers that can be explicitly cleared
+        this.sessionPassword = null;
+        this.sessionMnemonic = null; // can be a mnemonic or a zprv, can be changed to a zprv when using an imported wallet
+        // ===================================== PUBLIC METHODS - KEYRING MANAGER FOR HD - SYS ALL ===================================== //
+        this.setStorage = (client) => this.storage.setClient(client);
+        this.validateAccountType = (account) => {
+            return account.isImported === true
+                ? types_1.KeyringAccountType.Imported
+                : types_1.KeyringAccountType.HDAccount;
+        };
+        this.isUnlocked = () => !!this.sessionPassword && !this.sessionPassword.isCleared();
+        this.lockWallet = () => {
+            // Clear secure session data
+            if (this.sessionPassword) {
+                this.sessionPassword.clear();
+                this.sessionPassword = null;
+            }
+            if (this.sessionMnemonic) {
+                this.sessionMnemonic.clear();
+                this.sessionMnemonic = null;
+            }
+            // Clean up hardware wallet connections
+            if (this.ledgerSigner) {
+                this.ledgerSigner.destroy().catch((error) => {
+                    console.error('Error destroying Ledger connection:', error);
+                });
+            }
+            if (this.trezorSigner) {
+                this.trezorSigner.destroy().catch((error) => {
+                    console.error('Error destroying Trezor connection:', error);
+                });
+            }
+        };
+        // Direct secure transfer of session data to another keyring
+        this.transferSessionTo = (targetKeyring) => {
+            if (!this.isUnlocked()) {
+                throw new Error('Source keyring must be unlocked to transfer session');
+            }
+            // Cast to access the receiveSessionOwnership method
+            const targetKeyringImpl = targetKeyring;
+            // Transfer ownership of our buffers to the target
+            if (!this.sessionPassword || !this.sessionMnemonic) {
+                throw new Error('Session data is missing during transfer');
+            }
+            targetKeyringImpl.receiveSessionOwnership(this.sessionPassword, this.sessionMnemonic);
+            // Null out our references (do NOT clear buffers - target owns them now)
+            this.sessionPassword = null;
+            this.sessionMnemonic = null;
+        };
+        // Private method for zero-copy transfer - takes ownership of buffers
+        this.receiveSessionOwnership = (sessionPassword, sessionMnemonic) => {
+            // Clear any existing data first
+            if (this.sessionPassword) {
+                this.sessionPassword.clear();
+            }
+            if (this.sessionMnemonic) {
+                this.sessionMnemonic.clear();
+            }
+            // Take ownership of the actual SecureBuffer objects
+            // No copying - these are the original objects
+            this.sessionPassword = sessionPassword;
+            this.sessionMnemonic = sessionMnemonic;
+        };
+        this.addNewAccount = async (label) => {
+            // Check if wallet is unlocked
+            if (!this.isUnlocked()) {
+                throw new Error('Wallet must be unlocked to add new accounts');
+            }
+            // addNewAccount should only create accounts from the main seed
+            // For importing accounts (including zprvs), use importAccount
+            if (this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin) {
+                return await this.addNewAccountToSyscoinChain(label);
+            }
+            else {
+                // EVM chainType
+                return await this.addNewAccountToEth(label);
+            }
+        };
+        this.getNewChangeAddress = async () => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[activeAccount.id];
+            if (!account) {
+                throw new Error('Active account not found');
+            }
+            const { xpub } = account;
+            return await this.getAddress(xpub, true); // Don't skip increment - get next unused
+        };
+        this.getChangeAddress = async (id) => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[id];
+            if (!account) {
+                throw new Error(`Account with id ${id} not found`);
+            }
+            const { xpub } = account;
+            return await this.getAddress(xpub, true);
+        };
+        this.getPubkey = async (id, isChangeAddress) => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[id];
+            if (!account) {
+                throw new Error(`Account with id ${id} not found`);
+            }
+            const { xpub } = account;
+            return await this.getCurrentAddressPubkey(xpub, isChangeAddress);
+        };
+        this.getBip32Path = async (id, isChangeAddress) => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[id];
+            if (!account) {
+                throw new Error(`Account with id ${id} not found`);
+            }
+            const { xpub } = account;
+            return await this.getCurrentAddressBip32Path(xpub, isChangeAddress);
+        };
+        this.updateReceivingAddress = async () => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[activeAccount.id];
+            if (!account) {
+                throw new Error('Active account not found');
+            }
+            const { xpub } = account;
+            const address = await this.getAddress(xpub, false);
+            // NOTE: Address updates should be dispatched to Redux store, not updated here
+            // The calling code should handle the Redux dispatch
+            return address;
+        };
+        this.getAccountById = (id, accountType) => {
+            const vault = this.getVault();
+            const accounts = vault.accounts[accountType];
+            const account = accounts[id];
+            if (!account) {
+                throw new Error('Account not found');
+            }
+            return (0, omit_1.default)(account, 'xprv');
+        };
+        this.getPrivateKeyByAccountId = async (id, accountType, pwd) => {
+            try {
+                // Validate password using vault salt (same pattern as getSeed)
+                if (!this.sessionPassword) {
+                    throw new Error('Unlock wallet first');
+                }
+                // Get vault salt for password validation
+                const vaultKeys = await this.storage.get('vault-keys');
+                if (!vaultKeys || !vaultKeys.salt) {
+                    throw new Error('Vault keys not found');
+                }
+                const genPwd = this.encryptSHA512(pwd, vaultKeys.salt);
+                if (this.getSessionPasswordString() !== genPwd) {
+                    throw new Error('Invalid password');
+                }
+                const vault = this.getVault();
+                const account = vault.accounts[accountType][id];
+                if (!account) {
+                    throw new Error('Account not found');
+                }
+                // Decrypt the stored private key (works for both HD and imported accounts)
+                const decryptedPrivateKey = crypto_js_1.default.AES.decrypt(account.xprv, this.getSessionPasswordString()).toString(crypto_js_1.default.enc.Utf8);
+                if (!decryptedPrivateKey) {
+                    throw new Error('Failed to decrypt private key. Invalid password or corrupted data.');
+                }
+                return decryptedPrivateKey;
+            }
+            catch (error) {
+                console.log('ERROR getPrivateKeyByAccountId', {
+                    error,
+                });
+                this.validateAndHandleErrorByMessage(error.message);
+                throw error;
+            }
+        };
+        this.getActiveAccount = () => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const activeAccountId = activeAccount.id;
+            const activeAccountType = activeAccount.type;
+            return {
+                activeAccount: (0, omit_1.default)(accounts[activeAccountType][activeAccountId], 'xprv'),
+                activeAccountType,
+            };
+        };
+        this.getEncryptedXprv = (hd) => {
+            return crypto_js_1.default.AES.encrypt(this.getSysActivePrivateKey(hd), this.getSessionPasswordString()).toString();
+        };
+        this.getSeed = async (pwd) => {
+            if (!this.sessionPassword) {
+                throw new Error('Unlock wallet first');
+            }
+            // Get vault salt for password validation (consistent with getPrivateKeyByAccountId)
+            const vaultKeys = await this.storage.get('vault-keys');
+            if (!vaultKeys || !vaultKeys.salt) {
+                throw new Error('Vault keys not found');
+            }
+            const genPwd = this.encryptSHA512(pwd, vaultKeys.salt);
+            if (this.getSessionPasswordString() !== genPwd) {
+                throw new Error('Invalid password');
+            }
+            let { mnemonic } = await (0, storage_1.getDecryptedVault)(pwd);
+            if (!mnemonic) {
+                throw new Error('Mnemonic not found in vault or is empty');
+            }
+            // Try to detect if mnemonic is encrypted or plain text
+            const isLikelyPlainMnemonic = mnemonic.includes(' ') &&
+                (mnemonic.split(' ').length === 12 || mnemonic.split(' ').length === 24);
+            if (!isLikelyPlainMnemonic) {
+                try {
+                    mnemonic = crypto_js_1.default.AES.decrypt(mnemonic, pwd).toString(crypto_js_1.default.enc.Utf8);
+                }
+                catch (decryptError) {
+                    // If decryption fails, assume mnemonic is already decrypted
+                    console.warn('Mnemonic decryption failed in getSeed, using as-is:', decryptError.message);
+                }
+            }
+            if (!mnemonic) {
+                throw new Error('Failed to decrypt mnemonic or mnemonic is empty after decryption');
+            }
+            return mnemonic;
+        };
+        this.setSignerNetwork = async (network) => {
+            // With multi-keyring architecture, each keyring is dedicated to specific slip44
+            if (sysweb3_network_1.INetworkType.Ethereum !== network.kind &&
+                sysweb3_network_1.INetworkType.Syscoin !== network.kind) {
+                throw new Error('Unsupported chain');
+            }
+            // Validate network/chain type compatibility
+            if (network.kind === sysweb3_network_1.INetworkType.Ethereum &&
+                this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin) {
+                throw new Error('Cannot use Ethereum chain type with Syscoin network');
+            }
+            if (network.kind === sysweb3_network_1.INetworkType.Syscoin &&
+                this.getActiveChain() === sysweb3_network_1.INetworkType.Ethereum) {
+                throw new Error('Cannot use Syscoin chain type with Ethereum network');
+            }
+            // CRITICAL: Prevent UTXO-to-UTXO network switching within same keyring
+            // Each UTXO network should have its own KeyringManager instance based on slip44
+            const vault = this.getVault();
+            if (this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin && vault.activeNetwork) {
+                const currentSlip44 = vault.activeNetwork.slip44;
+                const newSlip44 = network.slip44;
+                if (currentSlip44 !== newSlip44) {
+                    throw new Error(`Cannot switch between different UTXO networks within the same keyring. ` +
+                        `Current network uses slip44=${currentSlip44}, target network uses slip44=${newSlip44}. ` +
+                        `Each UTXO network requires a separate KeyringManager instance.`);
+                }
+            }
+            try {
+                // With multi-keyring architecture:
+                // - UTXO: Each keyring is dedicated to one network (slip44), so this is only called during initialization
+                // - EVM: All EVM networks share slip44=60, so network can change within the same keyring
+                if (network.kind === sysweb3_network_1.INetworkType.Syscoin) {
+                    // For UTXO networks: validate that active account exists (accounts should be created via addNewAccount/initialize)
+                    const accountId = vault.activeAccount.id || 0;
+                    const accountType = vault.activeAccount.type || types_1.KeyringAccountType.HDAccount;
+                    const accounts = vault.accounts[accountType];
+                    if (!accounts[accountId] || !accounts[accountId].xpub) {
+                        throw new Error(`Active account ${accountType}:${accountId} does not exist. Create accounts using addNewAccount() or initializeWalletSecurely() first.`);
+                    }
+                    // No additional setup needed - on-demand signers will be created when needed
+                }
+                else if (network.kind === sysweb3_network_1.INetworkType.Ethereum) {
+                    // For EVM networks: validate that active account exists
+                    const accountId = vault.activeAccount.id || 0;
+                    const accountType = vault.activeAccount.type || types_1.KeyringAccountType.HDAccount;
+                    const accounts = vault.accounts[accountType];
+                    if (!accounts[accountId] || !accounts[accountId].xpub) {
+                        throw new Error(`Active account ${accountType}:${accountId} does not exist. Create accounts using addNewAccount() or initializeWalletSecurely() first.`);
+                    }
+                    // Set up EVM provider for network switching
+                    await this.setSignerEVM(network);
+                }
+                return {
+                    success: true,
+                };
+            }
+            catch (err) {
+                console.log('ERROR setSignerNetwork', {
+                    err,
+                });
+                this.validateAndHandleErrorByMessage(err.message);
+                //Rollback to previous values
+                console.error('Set Signer Network failed with', err);
+                return { success: false };
+            }
+        };
+        this.forgetMainWallet = async (pwd) => {
+            const vaultKeys = await this.storage.get('vault-keys');
+            if (!vaultKeys || !vaultKeys.salt) {
+                throw new Error('Vault keys not found');
+            }
+            const genPwd = this.encryptSHA512(pwd, vaultKeys.salt);
+            if (!this.sessionPassword) {
+                throw new Error('Unlock wallet first');
+            }
+            else if (this.getSessionPasswordString() !== genPwd) {
+                throw new Error('Invalid password');
+            }
+            await this.clearTemporaryLocalKeys(pwd);
+        };
+        this.importWeb3Account = (mnemonicOrPrivKey) => {
+            // Check if it's a hex string (Ethereum private key)
+            if (ethers_1.ethers.utils.isHexString(mnemonicOrPrivKey)) {
+                return new ethers_1.ethers.Wallet(mnemonicOrPrivKey);
+            }
+            // Check if it's a zprv/tprv (Syscoin private key)
+            const zprvPrefixes = ['zprv', 'tprv', 'vprv', 'xprv'];
+            if (zprvPrefixes.some((prefix) => mnemonicOrPrivKey.startsWith(prefix))) {
+                throw new Error('Syscoin extended private keys (zprv/tprv) should be imported using importAccount, not importWeb3Account');
+            }
+            // Otherwise, assume it's a mnemonic
+            const account = ethers_1.ethers.Wallet.fromMnemonic(mnemonicOrPrivKey);
+            return account;
+        };
+        this.getAccountXpub = () => {
+            const vault = this.getVault();
+            const { activeAccount } = vault;
+            const account = vault.accounts[activeAccount.type]?.[activeAccount.id];
+            if (!account) {
+                throw new Error('Active account not found');
+            }
+            return account.xpub;
+        };
+        this.isSeedValid = (seedPhrase) => (0, bip39_1.validateMnemonic)(seedPhrase);
+        this.createNewSeed = () => (0, bip39_1.generateMnemonic)();
+        this.getUTXOState = () => {
+            const vault = this.getVault();
+            if (vault.activeNetwork.kind !== sysweb3_network_1.INetworkType.Syscoin) {
+                throw new Error('Cannot get state in a ethereum network');
+            }
+            const utxOAccounts = (0, mapValues_1.default)(vault.accounts.HDAccount, (value) => (0, omit_1.default)(value, 'xprv'));
+            return {
+                ...vault,
+                accounts: {
+                    [types_1.KeyringAccountType.HDAccount]: utxOAccounts,
+                    [types_1.KeyringAccountType.Imported]: {},
+                    [types_1.KeyringAccountType.Trezor]: {},
+                    [types_1.KeyringAccountType.Ledger]: {},
+                },
+            };
+        };
+        this.getActiveUTXOAccountState = () => {
+            const vault = this.getVault();
+            const { activeAccount } = vault;
+            return {
+                ...vault.accounts.HDAccount[activeAccount.id],
+                xprv: undefined,
+            };
+        };
+        this.getNetwork = () => this.getVault().activeNetwork;
+        this.createEthAccount = (privateKey) => new ethers_1.ethers.Wallet(privateKey);
+        // Helper to get current account data from backend
+        this.fetchCurrentAccountData = async (xpub, isChangeAddress) => {
+            const vault = this.getVault();
+            const { activeNetwork } = vault;
+            // Use read-only signer for backend calls - works for all account types including hardware wallets
+            const { main } = this.getReadOnlySigner();
+            const options = 'tokens=used&details=tokens';
+            const { tokens } = await syscoinjs.utils.fetchBackendAccount(main.blockbookURL, xpub, options, true, undefined);
+            const { receivingIndex, changeIndex } = this.setLatestIndexesFromXPubTokens(tokens);
+            // Get network configuration for BIP84
+            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(activeNetwork.slip44, activeNetwork.currency);
+            // BIP84 needs pubTypes and networks config
+            // For read-only operations, we construct these from networkConfig
+            const pubTypes = networkConfig?.types?.zPubType || {
+                mainnet: { zprv: 0x04b2430c, zpub: 0x04b24746 },
+                testnet: { vprv: 0x045f18bc, vpub: 0x045f1cf6 },
+            };
+            const networks = networkConfig?.networks || {
+                mainnet: {},
+                testnet: {},
+            };
+            const currentAccount = new bip84_1.default.fromZPub(xpub, pubTypes, networks);
+            const addressIndex = isChangeAddress ? changeIndex : receivingIndex;
+            return {
+                currentAccount,
+                addressIndex,
+                main,
+            };
+        };
+        this.getAddress = async (xpub, isChangeAddress) => {
+            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
+            const address = currentAccount.getAddress(addressIndex, isChangeAddress, 84);
+            return address;
+        };
+        this.getCurrentAddressPubkey = async (xpub, isChangeAddress) => {
+            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
+            // BIP84 returns the public key as a hex string directly
+            return currentAccount.getPublicKey(addressIndex, isChangeAddress);
+        };
+        this.getCurrentAddressBip32Path = async (xpub, isChangeAddress) => {
+            const vault = this.getVault();
+            const { activeAccount, activeNetwork } = vault;
+            const { addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
+            // Use the utility function to generate the proper derivation path
+            const coinShortcut = activeNetwork.currency.toLowerCase(); // e.g., 'sys', 'btc'
+            const path = (0, derivation_paths_1.getAddressDerivationPath)(coinShortcut, activeNetwork.slip44, activeAccount.id, isChangeAddress, addressIndex);
+            return path;
+        };
+        this.logout = () => {
+            this.lockWallet();
+        };
+        /**
+         * PRIVATE METHODS
+         */
+        // ===================================== AUXILIARY METHOD - FOR TRANSACTIONS CLASSES ===================================== //
+        this.getDecryptedPrivateKey = () => {
+            try {
+                const vault = this.getVault();
+                const { accounts, activeAccount } = vault;
+                const activeAccountId = activeAccount.id;
+                const activeAccountType = activeAccount.type;
+                if (!this.sessionPassword)
+                    throw new Error('Wallet is locked cant proceed with transaction');
+                const activeAccountData = accounts[activeAccountType][activeAccountId];
+                if (!activeAccountData) {
+                    throw new Error(`Active account (${activeAccountType}:${activeAccountId}) not found. Account switching may be in progress.`);
+                }
+                const { xprv, address } = activeAccountData;
+                if (!xprv) {
+                    throw new Error(`Private key not found for account ${activeAccountType}:${activeAccountId}. Account may not be fully initialized.`);
+                }
+                let decryptedPrivateKey;
+                try {
+                    decryptedPrivateKey = crypto_js_1.default.AES.decrypt(xprv, this.getSessionPasswordString()).toString(crypto_js_1.default.enc.Utf8);
+                }
+                catch (decryptError) {
+                    throw new Error(`Failed to decrypt private key for account ${activeAccountType}:${activeAccountId}. The wallet may be locked or corrupted.`);
+                }
+                if (!decryptedPrivateKey) {
+                    throw new Error(`Decrypted private key is empty for account ${activeAccountType}:${activeAccountId}. Invalid password or corrupted data.`);
+                }
+                // For EVM accounts, validate that the derived address matches the stored address
+                // This helps catch account switching race conditions early
+                if (this.getActiveChain() === sysweb3_network_1.INetworkType.Ethereum) {
+                    try {
+                        const derivedWallet = new ethers_1.ethers.Wallet(decryptedPrivateKey);
+                        if (derivedWallet.address.toLowerCase() !== address.toLowerCase()) {
+                            throw new Error(`Address mismatch for account ${activeAccountType}:${activeAccountId}. Expected ${address} but derived ${derivedWallet.address}. Account switching may be in progress.`);
+                        }
+                    }
+                    catch (ethersError) {
+                        throw new Error(`Failed to validate EVM address for account ${activeAccountType}:${activeAccountId}: ${ethersError.message}`);
+                    }
+                }
+                return {
+                    address,
+                    decryptedPrivateKey,
+                };
+            }
+            catch (error) {
+                const vaultForLogging = this.getVault();
+                console.error('ERROR getDecryptedPrivateKey', {
+                    error: error.message,
+                    activeChain: this.getActiveChain(),
+                    vault: {
+                        activeAccountId: vaultForLogging?.activeAccount?.id,
+                        activeAccountType: vaultForLogging?.activeAccount?.type,
+                    },
+                });
+                this.validateAndHandleErrorByMessage(error.message);
+                throw error;
+            }
+        };
+        this.getSigner = () => {
+            if (!this.sessionPassword) {
+                throw new Error('Wallet is locked cant proceed with transaction');
+            }
+            if (this.getActiveChain() !== sysweb3_network_1.INetworkType.Syscoin) {
+                throw new Error('Switch to UTXO chain');
+            }
+            // Create fresh on-demand signer for active account (now synchronous!)
+            const freshHDSigner = this.createOnDemandSignerForActiveAccount();
+            // Create fresh syscoinjs instance with current network
+            const vault = this.getVault();
+            const network = vault.activeNetwork;
+            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
+            const syscoinMainSigner = new syscoinjs.SyscoinJSLib(freshHDSigner, network.url, networkConfig?.networks?.mainnet || undefined);
+            return {
+                hd: freshHDSigner,
+                main: syscoinMainSigner,
+            };
+        };
+        // Read-only version that works when wallet is locked
+        this.getReadOnlySigner = () => {
+            if (this.getActiveChain() !== sysweb3_network_1.INetworkType.Syscoin) {
+                throw new Error('Switch to UTXO chain');
+            }
+            // Create syscoinjs instance without HD signer for read-only operations
+            const vault = this.getVault();
+            const network = vault.activeNetwork;
+            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
+            const syscoinMainSigner = new syscoinjs.SyscoinJSLib(null, // No HD signer needed for read-only operations
+            network.url, networkConfig?.networks?.mainnet || undefined);
+            return {
+                main: syscoinMainSigner,
+            };
+        };
+        this.getAccountsState = () => {
+            const vault = this.getVault();
+            const { accounts, activeAccount, activeNetwork } = vault;
+            return {
+                activeAccountId: activeAccount.id,
+                accounts,
+                activeAccountType: activeAccount.type,
+                activeNetwork,
+            };
+        };
+        /**
+         *
+         * @param password
+         * @param salt
+         * @returns hash: string
+         */
+        this.encryptSHA512 = (password, salt) => crypto_1.default.createHmac('sha512', salt).update(password).digest('hex');
+        this.getSysActivePrivateKey = (hd) => {
+            if (hd === null)
+                throw new Error('No HD Signer');
+            const accountIndex = hd.Signer.accountIndex;
+            // Verify the account exists now
+            if (!hd.Signer.accounts.has(accountIndex)) {
+                throw new Error(`Account at index ${accountIndex} could not be created`);
+            }
+            return hd.Signer.accounts.get(accountIndex).getAccountPrivateKey();
+        };
+        this.getInitialAccountData = ({ label, signer, sysAccount, xprv, }) => {
+            const { address, xpub } = sysAccount;
+            return {
+                id: signer.Signer.accountIndex,
+                label: label || `Account ${signer.Signer.accountIndex + 1}`,
+                xpub,
+                xprv,
+                address,
+                isTrezorWallet: false,
+                isLedgerWallet: false,
+                isImported: false,
+            };
+        };
+        this.getFormattedBackendAccount = async ({ signer, }) => {
+            // MUCH SIMPLER: Just use the signer directly - no BIP84 needed!
+            // Get address directly from the signer (always correct for current network)
+            const address = signer.createAddress(0, false, 84);
+            const xpub = signer.getAccountXpub();
+            return {
+                address,
+                xpub,
+            };
+        };
+        this.setLatestIndexesFromXPubTokens = function (tokens) {
+            let changeIndexInternal = -1, receivingIndexInternal = -1;
+            if (tokens) {
+                tokens.forEach((token) => {
+                    if (!token.transfers || !token.path) {
+                        return {
+                            changeIndex: changeIndexInternal + 1,
+                            receivingIndex: receivingIndexInternal + 1,
+                        };
+                    }
+                    const transfers = parseInt(token.transfers, 10);
+                    if (token.path && transfers > 0) {
+                        const splitPath = token.path.split('/');
+                        if (splitPath.length >= 6) {
+                            const change = parseInt(splitPath[4], 10);
+                            const index = parseInt(splitPath[5], 10);
+                            if (change === 1) {
+                                if (index > changeIndexInternal) {
+                                    changeIndexInternal = index;
+                                }
+                            }
+                            else if (index > receivingIndexInternal) {
+                                receivingIndexInternal = index;
+                            }
+                        }
+                    }
+                });
+            }
+            return {
+                changeIndex: changeIndexInternal + 1,
+                receivingIndex: receivingIndexInternal + 1,
+            };
+        };
+        this.getBasicWeb3AccountInfo = (id, label) => {
+            return {
+                id,
+                isTrezorWallet: false,
+                isLedgerWallet: false,
+                label: label ? label : `Account ${id + 1}`,
+            };
+        };
+        this.setDerivedWeb3Accounts = async (id, label) => {
+            try {
+                // For account creation, derive from mnemonic (since account doesn't exist yet)
+                const mnemonic = this.getDecryptedMnemonic();
+                const hdNode = ethers_1.ethers.utils.HDNode.fromMnemonic(mnemonic);
+                const derivationPath = (0, derivation_paths_1.getAddressDerivationPath)('eth', 60, 0, false, id);
+                const derivedAccount = hdNode.derivePath(derivationPath);
+                const basicAccountInfo = this.getBasicWeb3AccountInfo(id, label);
+                const createdAccount = {
+                    address: derivedAccount.address,
+                    xpub: derivedAccount.publicKey,
+                    xprv: crypto_js_1.default.AES.encrypt(derivedAccount.privateKey, this.getSessionPasswordString()).toString(),
+                    isImported: false,
+                    ...basicAccountInfo,
+                    balances: { syscoin: 0, ethereum: 0 },
+                };
+                // NOTE: Account creation should be dispatched to Redux store, not stored here
+                // Return the account data for Pali to add to store
+                return createdAccount;
+            }
+            catch (error) {
+                console.log('ERROR setDerivedWeb3Accounts', {
+                    error,
+                });
+                this.validateAndHandleErrorByMessage(error.message);
+                throw error;
+            }
+        };
+        this.setSignerEVM = async (network) => {
+            const abortController = new AbortController();
+            try {
+                // With multi-keyring architecture, this is only called on EVM keyrings
+                this.ethereumTransaction.setWeb3Provider(network);
+                abortController.abort();
+            }
+            catch (error) {
+                abortController.abort();
+                throw new Error(`SetSignerEVM: Failed with ${error}`);
+            }
+        };
+        this.clearTemporaryLocalKeys = async (pwd) => {
+            // Clear the vault completely (set empty mnemonic)
+            await (0, storage_1.setEncryptedVault)({
+                mnemonic: '',
+            }, pwd);
+            // Remove vault-keys from storage so no vault exists at all
+            await this.storage.deleteItem('vault-keys');
+            console.log('[KeyringManager] Temporary local keys cleared');
+            this.logout();
+        };
+        // NEW: Separate session initialization from account creation
+        this.initializeSession = async (seedPhrase, password) => {
+            // Validate inputs first
+            if (!(0, bip39_1.validateMnemonic)(seedPhrase)) {
+                throw new Error('Invalid Seed');
+            }
+            let foundVaultKeys = true;
+            let salt = '';
+            const vaultKeys = await this.storage.get('vault-keys');
+            if (!vaultKeys || !vaultKeys.salt) {
+                foundVaultKeys = false;
+                salt = crypto_1.default.randomBytes(16).toString('hex');
+            }
+            else {
+                salt = vaultKeys.salt;
+            }
+            const sessionPasswordSaltedHash = this.encryptSHA512(password, salt);
+            if (!foundVaultKeys) {
+                // Store vault-keys using the storage abstraction
+                await this.storage.set('vault-keys', {
+                    hash: sessionPasswordSaltedHash,
+                    salt,
+                });
+            }
+            // Check if already initialized with the same password (idempotent behavior)
+            if (this.sessionPassword) {
+                if (sessionPasswordSaltedHash === this.getSessionPasswordString()) {
+                    // Same password - check if it's the same mnemonic to ensure full idempotency
+                    try {
+                        const currentMnemonic = crypto_js_1.default.AES.decrypt(this.getSessionMnemonicString(), this.getSessionPasswordString()).toString(crypto_js_1.default.enc.Utf8);
+                        if (currentMnemonic === seedPhrase) {
+                            // Same mnemonic and password - already initialized
+                            return;
+                        }
+                    }
+                    catch (error) {
+                        // If we can't decrypt, fall through to error
+                    }
+                }
+                // Different password or mnemonic - this is not a simple re-initialization
+                throw new Error('Wallet already initialized with different parameters. Create a new keyring instance for different parameters.');
+            }
+            // Encrypt and store vault (mnemonic storage) - now uses single vault for all networks
+            await (0, storage_1.setEncryptedVault)({
+                mnemonic: seedPhrase, // Store plain mnemonic - setEncryptedVault will encrypt the entire vault
+            }, password);
+            await this.recreateSessionFromVault(password, sessionPasswordSaltedHash);
+        };
+        // NEW: Create first account without signer setup
+        this.createFirstAccount = async (label) => {
+            if (!this.sessionPassword || !this.sessionMnemonic) {
+                throw new Error('Session must be initialized first. Call initializeSession.');
+            }
+            const vault = this.getVault();
+            const network = vault.activeNetwork;
+            if (network.kind === sysweb3_network_1.INetworkType.Syscoin) {
+                // UTXO accounts get network-aware labels since each network has separate keyrings
+                const defaultLabel = label || this.generateNetworkAwareLabel(0, network);
+                // Create UTXO account using on-demand signer
+                const freshHDSigner = this.createOnDemandUTXOSigner(0);
+                const sysAccount = await this.getFormattedBackendAccount({
+                    signer: freshHDSigner,
+                });
+                const encryptedXprv = this.getEncryptedXprv(freshHDSigner);
+                return {
+                    ...this.getInitialAccountData({
+                        label: defaultLabel,
+                        signer: freshHDSigner,
+                        sysAccount,
+                        xprv: encryptedXprv,
+                    }),
+                    balances: { syscoin: 0, ethereum: 0 },
+                };
+            }
+            else {
+                // EVM accounts get generic labels since they work across all EVM networks
+                const defaultLabel = label || 'Account 1';
+                return await this.setDerivedWeb3Accounts(0, defaultLabel);
+            }
+        };
+        this.initializeWalletSecurely = async (seedPhrase, password) => {
+            // Use new separated approach
+            await this.initializeSession(seedPhrase, password);
+            return await this.createFirstAccount();
+        };
+        this.storage = sysweb3.sysweb3Di.getStateStorageDb();
+        // Don't initialize secure buffers in constructor - they're created on unlock
+        this.storage.set('utf8Error', {
+            hasUtf8Error: false,
+        });
+        // NOTE: activeChain is now derived from vault state, not stored locally
+        // NOTE: No more persistent signers - use getSigner() for fresh on-demand signers
+        this.utf8Error = false;
+        // sessionMnemonic is initialized as null - created on unlock
+        this.initialTrezorAccountState = initial_state_1.initialActiveTrezorAccountState;
+        this.initialLedgerAccountState = initial_state_1.initialActiveLedgerAccountState;
+        this.trezorSigner = new trezor_1.TrezorKeyring(this.getSigner);
+        this.ledgerSigner = new ledger_1.LedgerKeyring();
+        // this.syscoinTransaction = SyscoinTransactions();
+        this.syscoinTransaction = new transactions_1.SyscoinTransactions(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.getAddress, this.ledgerSigner, this.trezorSigner);
+        this.ethereumTransaction = new transactions_1.EthereumTransactions(this.getNetwork, this.getDecryptedPrivateKey, this.getAccountsState, this.ledgerSigner, this.trezorSigner);
+    }
+    // Static factory method for creating a fully initialized KeyringManager with slip44 support
+    static async createInitialized(seed, password, vaultStateGetter) {
+        const keyringManager = new KeyringManager();
+        // Set the vault state getter
+        keyringManager.setVaultStateGetter(vaultStateGetter);
+        // Use the new secure initialization method (eliminates temporary plaintext storage)
+        await keyringManager.initializeWalletSecurely(seed, password);
+        // NOTE: Active account management is now handled by vault state/Redux
+        // No need to explicitly set active account - it's managed externally
+        return keyringManager;
+    }
+    // Convenience method for complete setup after construction
+    async initialize(seed, password, network) {
+        // Set the network if provided (this is crucial for proper address derivation)
+        if (network) {
+            await this.setSignerNetwork(network);
+        }
+        // Use the new secure initialization method (eliminates temporary plaintext storage)
+        const account = await this.initializeWalletSecurely(seed, password);
+        // NOTE: Active account management is now handled by vault state/Redux
+        // No need to explicitly set active account - it's managed externally
+        return account;
+    }
+    async unlock(password) {
+        try {
+            const vaultKeys = await this.storage.get('vault-keys');
+            if (!vaultKeys) {
+                return {
+                    canLogin: false,
+                };
+            }
+            // FIRST: Validate password against stored hash
+            const { hash, salt } = vaultKeys;
+            const saltedHashPassword = this.encryptSHA512(password, salt);
+            if (saltedHashPassword !== hash) {
+                // Password is wrong - return immediately
+                return {
+                    canLogin: false,
+                };
+            }
+            // Handle migration from old vault format with currentSessionSalt
+            if (vaultKeys.currentSessionSalt) {
+                console.log('[KeyringManager] Detected old vault format, handling session migration...');
+                // The old format used currentSessionSalt for session data encryption
+                // We need to use it temporarily to decrypt the mnemonic correctly
+                const oldSessionPassword = this.encryptSHA512(password, vaultKeys.currentSessionSalt);
+                // Get the vault and check if mnemonic needs migration
+                const { mnemonic } = await (0, storage_1.getDecryptedVault)(password);
+                if (mnemonic) {
+                    // Check if mnemonic is double-encrypted (old format behavior)
+                    const isLikelyPlainMnemonic = mnemonic.includes(' ') &&
+                        (mnemonic.split(' ').length === 12 ||
+                            mnemonic.split(' ').length === 24);
+                    let decryptedMnemonic = mnemonic;
+                    if (!isLikelyPlainMnemonic) {
+                        try {
+                            // Try to decrypt with raw password first (as vault stores it)
+                            decryptedMnemonic = crypto_js_1.default.AES.decrypt(mnemonic, password).toString(crypto_js_1.default.enc.Utf8);
+                        }
+                        catch (e) {
+                            console.warn('[KeyringManager] Failed to decrypt mnemonic with password, trying old session password');
+                            // If that fails, try with old session password
+                            try {
+                                decryptedMnemonic = crypto_js_1.default.AES.decrypt(mnemonic, oldSessionPassword).toString(crypto_js_1.default.enc.Utf8);
+                            }
+                            catch (e2) {
+                                // If both fail, assume it's already decrypted
+                                decryptedMnemonic = mnemonic;
+                            }
+                        }
+                    }
+                    // Re-save the vault with properly formatted mnemonic (single encryption)
+                    await (0, storage_1.setEncryptedVault)({ mnemonic: decryptedMnemonic }, password);
+                    console.log('[KeyringManager] Vault mnemonic format normalized');
+                }
+                // Remove currentSessionSalt from vault-keys
+                const migratedVaultKeys = {
+                    hash: vaultKeys.hash,
+                    salt: vaultKeys.salt,
+                };
+                await this.storage.set('vault-keys', migratedVaultKeys);
+                console.log('[KeyringManager] Old vault format migration completed');
+            }
+            // If session data missing or corrupted, recreate from vault
+            if (!this.sessionMnemonic) {
+                await this.recreateSessionFromVault(password, saltedHashPassword);
+            }
+            // NOTE: Active account management is now handled by vault state/Redux
+            // No need to explicitly set active account after unlock - it's managed externally
+            const vault = this.getVault();
+            if (vault.activeAccount?.id !== undefined && vault.activeAccount?.type) {
+                // Check if the active account actually exists in the accounts map
+                const accountType = vault.activeAccount.type;
+                const accountId = vault.activeAccount.id;
+                const accountExists = vault.accounts?.[accountType]?.[accountId];
+                if (!accountExists) {
+                    console.log(`[KeyringManager] Active account ${accountType}:${accountId} not found in accounts map. This may indicate a migration from old vault format.`);
+                    // Signal that accounts need to be created after migration
+                    return {
+                        canLogin: true,
+                        needsAccountCreation: true,
+                    };
+                }
+                console.log(`[KeyringManager] Active account ${vault.activeAccount.id} available after unlock`);
+            }
+            return {
+                canLogin: true,
+            };
+        }
+        catch (error) {
+            console.log('ERROR unlock', {
+                error,
+            });
+            return {
+                canLogin: false,
+            };
+        }
+    }
+    async importTrezorAccount(label) {
+        const vault = this.getVault();
+        const currency = vault.activeNetwork.currency;
+        if (!currency) {
+            throw new Error('Active network currency is not defined');
+        }
+        // Use getNextAccountId to filter out placeholder accounts
+        const nextIndex = this.getNextAccountId(vault.accounts[types_1.KeyringAccountType.Trezor]);
+        const importedAccount = await this._createTrezorAccount(currency, vault.activeNetwork.slip44, nextIndex);
+        importedAccount.label = label ? label : `Trezor ${importedAccount.id + 1}`;
+        // NOTE: Account creation should be dispatched to Redux store, not updated here
+        // The calling code should handle the Redux dispatch
+        // Return the created account for Pali to add to store
+        return importedAccount;
+    }
+    async importLedgerAccount(label) {
+        try {
+            const vault = this.getVault();
+            const currency = vault.activeNetwork.currency;
+            if (!currency) {
+                throw new Error('Active network currency is not defined');
+            }
+            // Use getNextAccountId to filter out placeholder accounts
+            const nextIndex = this.getNextAccountId(vault.accounts[types_1.KeyringAccountType.Ledger]);
+            const importedAccount = await this._createLedgerAccount(currency, vault.activeNetwork.slip44, nextIndex);
+            importedAccount.label = label
+                ? label
+                : `Ledger ${importedAccount.id + 1}`;
+            // NOTE: Account creation should be dispatched to Redux store, not updated here
+            // The calling code should handle the Redux dispatch
+            // Return the created account for Pali to add to store
+            return importedAccount;
+        }
+        catch (error) {
+            console.log({ error });
+            throw error;
+        }
+    }
+    async importAccount(privKey, label) {
+        // Check if wallet is unlocked
+        if (!this.isUnlocked()) {
+            throw new Error('Wallet must be unlocked to import accounts');
+        }
+        const importedAccount = await this._getPrivateKeyAccountInfos(privKey, label);
+        // NOTE: Account creation should be dispatched to Redux store, not updated here
+        // The calling code should handle the Redux dispatch
+        // Return the created account for Pali to add to store
+        return importedAccount;
+    }
+    validateZprv(zprv, targetNetwork) {
+        // Use the active network if targetNetwork is not provided
+        const networkToValidateAgainst = targetNetwork || this.getVault().activeNetwork;
+        if (!networkToValidateAgainst) {
+            throw new Error('No network available for validation');
+        }
+        try {
+            // Check if it looks like an extended key based on known prefixes
+            const knownExtendedKeyPrefixes = [
+                'xprv',
+                'xpub',
+                'yprv',
+                'ypub',
+                'zprv',
+                'zpub',
+                'tprv',
+                'tpub',
+                'uprv',
+                'upub',
+                'vprv',
+                'vpub',
+            ];
+            const prefix = zprv.substring(0, 4);
+            const looksLikeExtendedKey = knownExtendedKeyPrefixes.includes(prefix);
+            // Only check prefix validity if it looks like an extended key
+            if (looksLikeExtendedKey) {
+                const validBip84Prefixes = ['zprv', 'vprv']; // zprv for mainnet, vprv for testnet
+                if (!validBip84Prefixes.includes(prefix)) {
+                    throw new Error(`Invalid key prefix '${prefix}'. Only BIP84 keys (zprv/vprv) are supported for UTXO imports. BIP44 keys (xprv/tprv) are not supported.`);
+                }
+            }
+            else {
+                // Not an extended key format
+                throw new Error('Not an extended private key');
+            }
+            const bip32 = (0, bip32_1.BIP32Factory)(secp256k1_1.default);
+            const decoded = bs58check_1.default.decode(zprv);
+            if (decoded.length !== 78) {
+                throw new Error('Invalid length for a BIP-32 key');
+            }
+            // Get network configuration for the target network
+            const { networks, types } = (0, sysweb3_network_1.getNetworkConfig)(networkToValidateAgainst.slip44, networkToValidateAgainst.currency || 'Bitcoin');
+            // For BIP84 (zprv/zpub), we need to use the correct magic bytes from zPubType
+            // Determine key type: zprv = mainnet key, vprv = testnet key
+            const keyIsTestnet = prefix === 'vprv';
+            // Determine target network type: testnet networks typically have chainId 5700+ or slip44 1
+            const targetIsTestnet = networkToValidateAgainst.chainId >= 5700 ||
+                networkToValidateAgainst.slip44 === 1;
+            // Cross-network validation: reject if key type doesn't match target network
+            if (keyIsTestnet && !targetIsTestnet) {
+                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. ` +
+                    `This appears to be a testnet key (${prefix}) but the target network is mainnet.`);
+            }
+            if (!keyIsTestnet && targetIsTestnet) {
+                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. ` +
+                    `This appears to be a mainnet key (${prefix}) but the target network is testnet.`);
+            }
+            const pubTypes = keyIsTestnet
+                ? types.zPubType.testnet
+                : types.zPubType.mainnet;
+            const baseNetwork = keyIsTestnet ? networks.testnet : networks.mainnet;
+            const network = {
+                ...baseNetwork,
+                bip32: {
+                    public: parseInt(pubTypes.vpub || pubTypes.zpub, 16),
+                    private: parseInt(pubTypes.vprv || pubTypes.zprv, 16),
+                },
+            };
+            // Validate that the key prefix matches the expected network format
+            // This ensures the key was generated for a compatible network
+            const expectedPrefixes = ['zprv', 'vprv', 'xprv', 'yprv']; // Accept various BIP32/84 formats
+            if (!expectedPrefixes.includes(prefix)) {
+                throw new Error(`Invalid extended private key prefix: ${prefix}. Expected one of: ${expectedPrefixes.join(', ')}`);
+            }
+            // Strict network matching - only allow keys that match the target network
+            let node;
+            try {
+                node = bip32.fromBase58(zprv, network);
+            }
+            catch (e) {
+                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. Please use a key generated for this specific network.`);
+            }
+            if (!node.privateKey) {
+                throw new Error('Private key not found in extended private key');
+            }
+            if (!secp256k1_1.default.isPrivate(node.privateKey)) {
+                throw new Error('Invalid private key for secp256k1 curve');
+            }
+            return {
+                isValid: true,
+                node,
+                network,
+                message: 'The extended private key is valid for this network.',
+            };
+        }
+        catch (error) {
+            return { isValid: false, message: error.message };
+        }
+    }
+    validateAndHandleErrorByMessage(message) {
+        const utf8ErrorMessage = 'Malformed UTF-8 data';
+        if (message.includes(utf8ErrorMessage) ||
+            message.toLowerCase().includes(utf8ErrorMessage.toLowerCase())) {
+            this.storage.set('utf8Error', { hasUtf8Error: true });
+        }
+    }
+    async _createTrezorAccount(coin, slip44, index, label) {
+        const vault = this.getVault();
+        const { accounts } = vault;
+        let xpub, balance;
+        // For EVM networks, Trezor expects 'eth' regardless of the network's currency
+        const trezorCoin = slip44 === 60 ? 'eth' : coin;
+        try {
+            const { descriptor, balance: _balance } = await this.trezorSigner.getAccountInfo({
+                coin: trezorCoin,
+                slip44,
+                index,
+            });
+            xpub = descriptor;
+            balance = _balance;
+        }
+        catch (e) {
+            throw new Error(e);
+        }
+        let ethPubKey = '';
+        const isEVM = (0, derivation_paths_1.isEvmCoin)(coin, slip44);
+        // For EVM networks, we need to get the actual address from Trezor
+        let address;
+        if (isEVM) {
+            // For EVM, the descriptor from getAccountInfo is the address
+            address = xpub;
+            // Get the public key for EVM
+            const response = await this.trezorSigner.getPublicKey({
+                coin: trezorCoin,
+                slip44,
+                index: +index,
+            });
+            ethPubKey = response.publicKey;
+        }
+        else {
+            // For UTXO, use the xpub to derive the address
+            address = await this.getAddress(xpub, false);
+        }
+        const accountAlreadyExists = Object.values(accounts[types_1.KeyringAccountType.Ledger]).some((account) => account.address === address) ||
+            Object.values(accounts[types_1.KeyringAccountType.Trezor]).some((account) => account.address === address) ||
+            Object.values(accounts[types_1.KeyringAccountType.HDAccount]).some((account) => account.address === address) ||
+            Object.values(accounts[types_1.KeyringAccountType.Imported]).some((account) => account.address === address);
+        if (accountAlreadyExists)
+            throw new Error('Account already exists on your Wallet.');
+        if (!xpub || !address)
+            throw new Error('Something wrong happened. Please, try again or report it');
+        // Use getNextAccountId to properly handle placeholder accounts
+        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Trezor]);
+        const trezorAccount = {
+            ...this.initialTrezorAccountState,
+            balances: {
+                syscoin: isEVM ? 0 : +balance / 1e8,
+                ethereum: 0,
+            },
+            address,
+            label: label ? label : `Trezor ${id + 1}`,
+            id,
+            xprv: '',
+            xpub: isEVM ? ethPubKey : xpub,
+            assets: {
+                syscoin: [],
+                ethereum: [],
+            },
+        };
+        return trezorAccount;
+    }
+    async _createLedgerAccount(coin, slip44, index, label) {
+        const vault = this.getVault();
+        const { accounts } = vault;
+        let xpub;
+        let address = '';
+        if ((0, derivation_paths_1.isEvmCoin)(coin, slip44)) {
+            const { address: ethAddress, publicKey } = await this.ledgerSigner.evm.getEvmAddressAndPubKey({
+                accountIndex: index,
+            });
+            address = ethAddress;
+            xpub = publicKey;
+        }
+        else {
+            try {
+                const ledgerXpub = await this.ledgerSigner.utxo.getXpub({
+                    index: index,
+                    coin,
+                    slip44,
+                });
+                xpub = ledgerXpub;
+                // Use the generic getAddress method like Trezor does - no need to query device again
+                address = await this.getAddress(xpub, false);
+            }
+            catch (e) {
+                throw new Error(e);
+            }
+        }
+        const accountAlreadyExists = Object.values(accounts[types_1.KeyringAccountType.Ledger]).some((account) => account.address === address) ||
+            Object.values(accounts[types_1.KeyringAccountType.Trezor]).some((account) => account.address === address) ||
+            Object.values(accounts[types_1.KeyringAccountType.HDAccount]).some((account) => account.address === address) ||
+            Object.values(accounts[types_1.KeyringAccountType.Imported]).some((account) => account.address === address);
+        if (accountAlreadyExists)
+            throw new Error('Account already exists on your Wallet.');
+        if (!xpub || !address)
+            throw new Error('Something wrong happened. Please, try again or report it');
+        // Use getNextAccountId to properly handle placeholder accounts
+        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Ledger]);
+        const currentBalances = { syscoin: 0, ethereum: 0 };
+        const ledgerAccount = {
+            ...this.initialLedgerAccountState,
+            balances: currentBalances,
+            address,
+            label: label ? label : `Ledger ${id + 1}`,
+            id,
+            xprv: '',
+            xpub,
+            assets: {
+                syscoin: [],
+                ethereum: [],
+            },
+        };
+        return ledgerAccount;
+    }
+    // Common helper method for UTXO account creation
+    async createUTXOAccountAtIndex(accountId, label) {
+        try {
+            // Create fresh signer just for this account creation operation
+            const freshHDSigner = this.createOnDemandUTXOSigner(accountId);
+            const sysAccount = await this.getFormattedBackendAccount({
+                signer: freshHDSigner,
+            });
+            const encryptedXprv = this.getEncryptedXprv(freshHDSigner);
+            // Generate network-aware label if none provided
+            const vault = this.getVault();
+            const network = vault.activeNetwork;
+            const defaultLabel = this.generateNetworkAwareLabel(accountId, network);
+            return {
+                ...this.getInitialAccountData({
+                    label: label || defaultLabel,
+                    signer: freshHDSigner,
+                    sysAccount,
+                    xprv: encryptedXprv,
+                }),
+                balances: { syscoin: 0, ethereum: 0 },
+            };
+        }
+        catch (error) {
+            console.log('ERROR createUTXOAccountAtIndex', {
+                error,
+            });
+            this.validateAndHandleErrorByMessage(error.message);
+            throw error;
+        }
+    }
+    async addNewAccountToSyscoinChain(label) {
+        try {
+            // Get next available account ID
+            const vault = this.getVault();
+            const accounts = vault.accounts[types_1.KeyringAccountType.HDAccount];
+            const nextId = this.getNextAccountId(accounts);
+            return await this.createUTXOAccountAtIndex(nextId, label);
+        }
+        catch (error) {
+            console.log('ERROR addNewAccountToSyscoinChain', {
+                error,
+            });
+            this.validateAndHandleErrorByMessage(error.message);
+            throw error;
+        }
+    }
+    async addNewAccountToEth(label) {
+        try {
+            // Get next available account ID
+            const vault = this.getVault();
+            const accounts = vault.accounts[types_1.KeyringAccountType.HDAccount];
+            const nextId = this.getNextAccountId(accounts);
+            // EVM accounts should use generic labels since they work across all EVM networks
+            const defaultLabel = `Account ${nextId + 1}`;
+            const newAccount = await this.setDerivedWeb3Accounts(nextId, label || defaultLabel);
+            return newAccount;
+        }
+        catch (error) {
+            console.log('ERROR addNewAccountToEth', {
+                error,
+            });
+            this.validateAndHandleErrorByMessage(error.message);
+            throw error;
+        }
+    }
+    // Helper method to get next available account ID - fills gaps when accounts are deleted
+    getNextAccountId(accounts) {
+        const existingIds = Object.values(accounts)
+            .filter((account) => {
+            // Only count accounts that have been properly initialized
+            // Placeholder accounts have empty addresses/xprv/xpub
+            return account && account.address && account.xpub;
+        })
+            .map((account) => account.id)
+            .filter((id) => !isNaN(id))
+            .sort((a, b) => a - b); // Sort to find gaps efficiently
+        if (existingIds.length === 0) {
+            return 0;
+        }
+        // Find the first gap in the sequence
+        for (let i = 0; i < existingIds.length; i++) {
+            if (existingIds[i] !== i) {
+                // Found a gap at position i
+                return i;
+            }
+        }
+        // No gaps found, return next sequential ID
+        return existingIds.length;
+    }
+    async recreateSessionFromVault(password, saltedHashPassword) {
+        try {
+            const { mnemonic } = await (0, storage_1.getDecryptedVault)(password);
+            if (!mnemonic) {
+                throw new Error('Mnemonic not found in vault');
+            }
+            // Encrypt session data with sessionPassword hash for consistency
+            // This allows keyring manager to decrypt with this.sessionPassword
+            this.sessionPassword = new SecureBuffer(saltedHashPassword);
+            // Encrypt the mnemonic with session password for consistency with the rest of the code
+            const encryptedMnemonic = crypto_js_1.default.AES.encrypt(mnemonic, saltedHashPassword).toString();
+            this.sessionMnemonic = new SecureBuffer(encryptedMnemonic);
+            console.log('[KeyringManager] Session data recreated from vault');
+        }
+        catch (error) {
+            console.error('ERROR recreateSessionFromVault', { error });
+            throw error;
+        }
+    }
+    async _getPrivateKeyAccountInfos(privKey, label) {
+        const vault = this.getVault();
+        const { accounts } = vault;
+        let importedAccountValue;
+        const balances = {
+            syscoin: 0,
+            ethereum: 0,
+        };
+        // Try to validate as extended private key first, regardless of prefix
+        const networkToUse = vault.activeNetwork;
+        const zprvValidation = this.validateZprv(privKey, networkToUse);
+        if (zprvValidation.isValid) {
+            const { node, network } = zprvValidation;
+            if (!node || !network) {
+                throw new Error('Failed to validate extended private key');
+            }
+            // Always use index 0 for consistency
+            const nodeChild = node.derivePath(`0/0`);
+            if (!nodeChild) {
+                throw new Error('Failed to derive child node');
+            }
+            const { address } = bjs.payments.p2wpkh({
+                pubkey: nodeChild.publicKey,
+                network,
+            });
+            if (!address) {
+                throw new Error('Failed to generate address');
+            }
+            importedAccountValue = {
+                address,
+                publicKey: node.neutered().toBase58(),
+                privateKey: privKey,
+            };
+            balances.syscoin = 0;
+        }
+        else {
+            // Check if the validation failed due to network mismatch
+            if (zprvValidation.message &&
+                zprvValidation.message.includes('Network mismatch')) {
+                throw new Error(zprvValidation.message);
+            }
+            // Check if the validation failed due to invalid key prefix (only for known extended key formats)
+            if (zprvValidation.message &&
+                zprvValidation.message.includes('Invalid key prefix')) {
+                throw new Error(zprvValidation.message);
+            }
+            // Check if it failed parsing as an extended key
+            if (zprvValidation.message &&
+                zprvValidation.message.includes('Failed to parse extended private key')) {
+                throw new Error(zprvValidation.message);
+            }
+            // If it's not an extended key, treat it as an Ethereum private key
+            const hexPrivateKey = privKey.slice(0, 2) === '0x' ? privKey : `0x${privKey}`;
+            // Validate it's a valid hex string (32 bytes = 64 hex chars)
+            if (!/^0x[0-9a-fA-F]{64}$/.test(hexPrivateKey) &&
+                !/^[0-9a-fA-F]{64}$/.test(privKey)) {
+                throw new Error('Invalid private key format. Expected 32-byte hex string or extended private key.');
+            }
+            importedAccountValue =
+                this.ethereumTransaction.importAccount(hexPrivateKey);
+            balances.ethereum = 0;
+        }
+        const { address, publicKey, privateKey } = importedAccountValue;
+        //Validate if account already exists
+        const accountAlreadyExists = (accounts[types_1.KeyringAccountType.Imported] &&
+            Object.values(accounts[types_1.KeyringAccountType.Imported]).some((account) => account.address === address)) ||
+            Object.values(accounts[types_1.KeyringAccountType.HDAccount]).some((account) => account.address === address); //Find a way to verify if private Key is not par of seed wallet derivation path
+        if (accountAlreadyExists)
+            throw new Error('Account already exists, try again with another Private Key.');
+        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Imported]);
+        // Generate appropriate label based on account type
+        const network = vault.activeNetwork;
+        let defaultLabel;
+        if (zprvValidation.isValid) {
+            // UTXO imported account - use network-aware label
+            const networkPrefix = network.label;
+            defaultLabel = label || `${networkPrefix} Imported ${id + 1}`;
+        }
+        else {
+            // EVM imported account - use generic label
+            defaultLabel = label || `Imported ${id + 1}`;
+        }
+        return {
+            ...initial_state_1.initialActiveImportedAccountState,
+            address,
+            label: defaultLabel,
+            id,
+            balances,
+            isImported: true,
+            xprv: crypto_js_1.default.AES.encrypt(privateKey, this.getSessionPasswordString()).toString(),
+            xpub: publicKey,
+            assets: {
+                syscoin: [],
+                ethereum: [],
+            },
+        };
+    }
+    // NEW: On-demand signer creation methods
+    /**
+     * Common method to decrypt mnemonic from session
+     * Eliminates code duplication across multiple methods
+     */
+    getDecryptedMnemonic() {
+        if (!this.sessionMnemonic || !this.sessionPassword) {
+            throw new Error('Session information not available');
+        }
+        const mnemonic = crypto_js_1.default.AES.decrypt(this.getSessionMnemonicString(), this.getSessionPasswordString()).toString(crypto_js_1.default.enc.Utf8);
+        if (!mnemonic) {
+            throw new Error('Failed to decrypt mnemonic');
+        }
+        return mnemonic;
+    }
+    /**
+     * Creates network RPC config from current active network without making RPC calls
+     * Common utility for all on-demand signer creation
+     */
+    createNetworkRpcConfig() {
+        const network = this.getVault().activeNetwork;
+        return {
+            formattedNetwork: network,
+            networkConfig: (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency),
+        };
+    }
+    /**
+     * Common signer creation logic - takes decrypted mnemonic/zprv and creates fresh signer
+     * OPTIMIZED: No RPC call needed - uses network config directly
+     */
+    createFreshUTXOSigner(mnemonicOrZprv, accountId) {
+        // Create signer using network config directly (no RPC call)
+        const rpcConfig = this.createNetworkRpcConfig();
+        // Type assertion to match getSyscoinSigners expected interface
+        const { hd } = (0, signers_1.getSyscoinSigners)({
+            mnemonic: mnemonicOrZprv,
+            rpc: rpcConfig,
+        });
+        // Create account at the specified index and set it as active
+        // Note: createAccountAtIndex is synchronous despite TypeScript types
+        hd.createAccountAtIndex(accountId, 84);
+        // Verify the account was created correctly
+        if (!hd.Signer.accounts.has(accountId)) {
+            throw new Error(`Failed to create account at index ${accountId}`);
+        }
+        // Verify the correct account is active
+        if (hd.Signer.accountIndex !== accountId) {
+            throw new Error(`Account index mismatch: expected ${accountId}, got ${hd.Signer.accountIndex}`);
+        }
+        return hd;
+    }
+    /**
+     * Creates a fresh UTXO signer for HD accounts derived from the main seed
+     * OPTIMIZED: No RPC call needed - uses network config directly
+     */
+    createOnDemandUTXOSigner(accountId) {
+        // Use common method to avoid code duplication
+        const mnemonic = this.getDecryptedMnemonic();
+        return this.createFreshUTXOSigner(mnemonic, accountId);
+    }
+    /**
+     * Creates a fresh UTXO signer for imported accounts from stored zprv
+     * OPTIMIZED: No RPC call needed - uses network config directly
+     */
+    createOnDemandUTXOSignerFromImported(accountId) {
+        if (!this.sessionPassword) {
+            throw new Error('Session password not available');
+        }
+        const vault = this.getVault();
+        const account = vault.accounts[types_1.KeyringAccountType.Imported][accountId];
+        if (!account) {
+            throw new Error(`Imported account ${accountId} not found`);
+        }
+        // Decrypt the stored zprv
+        const zprv = crypto_js_1.default.AES.decrypt(account.xprv, this.getSessionPasswordString()).toString(crypto_js_1.default.enc.Utf8);
+        if (!zprv) {
+            throw new Error('Failed to decrypt imported account private key');
+        }
+        if (!this.isZprv(zprv)) {
+            throw new Error('Imported account does not contain a valid zprv');
+        }
+        return this.createFreshUTXOSigner(zprv, accountId);
+    }
+    /**
+     * Common method to create on-demand signer for active account
+     * Handles account type determination and delegates to appropriate method
+     */
+    createOnDemandSignerForActiveAccount() {
+        const vault = this.getVault();
+        const { activeAccount } = vault;
+        const accountId = activeAccount.id;
+        const accountType = activeAccount.type;
+        if (accountType === types_1.KeyringAccountType.HDAccount) {
+            return this.createOnDemandUTXOSigner(accountId);
+        }
+        else if (accountType === types_1.KeyringAccountType.Imported) {
+            return this.createOnDemandUTXOSignerFromImported(accountId);
+        }
+        else {
+            throw new Error(`Unsupported account type for UTXO signing: ${accountType}`);
+        }
+    }
+    // NEW: Helper methods for HD signer management
+    isZprv(key) {
+        const zprvPrefixes = ['zprv', 'tprv', 'vprv', 'xprv'];
+        return zprvPrefixes.some((prefix) => key.startsWith(prefix));
+    }
+    // Helper methods for secure buffer operations
+    getSessionPasswordString() {
+        if (!this.sessionPassword || this.sessionPassword.isCleared()) {
+            throw new Error('Session password not available');
+        }
+        return this.sessionPassword.toString();
+    }
+    getSessionMnemonicString() {
+        if (!this.sessionMnemonic || this.sessionMnemonic.isCleared()) {
+            throw new Error('Session mnemonic not available');
+        }
+        return this.sessionMnemonic.toString();
+    }
+    generateNetworkAwareLabel(accountId, network) {
+        // Generate concise network-specific labels using actual network config
+        const { label, chainId, kind, currency } = network;
+        // Create a shortened network identifier based on actual network configurations
+        let networkPrefix = '';
+        if (kind === sysweb3_network_1.INetworkType.Syscoin) {
+            // UTXO networks (slip44 = 57 for mainnet, 1 for testnet)
+            if (chainId === 57) {
+                networkPrefix = 'SYS'; // Syscoin UTXO Mainnet
+            }
+            else if (chainId === 5700) {
+                networkPrefix = 'SYS-T'; // Syscoin UTXO Testnet (slip44=1)
+            }
+            else {
+                // Other UTXO networks - use currency shortcut (e.g., "btc" -> "BTC")
+                if (currency) {
+                    networkPrefix = currency.toUpperCase();
+                }
+                else {
+                    // Fallback to first word from label if no currency
+                    const firstWord = label.split(' ')[0];
+                    networkPrefix =
+                        firstWord.length > 6 ? firstWord.substring(0, 6) : firstWord;
+                }
+            }
+        }
+        else {
+            // EVM networks (all use slip44=60)
+            if (chainId === 1) {
+                networkPrefix = 'ETH'; // Ethereum Mainnet
+            }
+            else if (chainId === 11155111) {
+                networkPrefix = 'ETH-T'; // Ethereum Sepolia Testnet
+            }
+            else if (chainId === 137) {
+                networkPrefix = 'POLY'; // Polygon Mainnet
+            }
+            else if (chainId === 80001) {
+                networkPrefix = 'POLY-T'; // Polygon Mumbai Testnet
+            }
+            else if (chainId === 57) {
+                networkPrefix = 'NEVM'; // Syscoin NEVM Mainnet
+            }
+            else if (chainId === 5700) {
+                networkPrefix = 'NEVM-T'; // Syscoin NEVM Testnet
+            }
+            else if (chainId === 570) {
+                networkPrefix = 'ROLLUX'; // Rollux Mainnet
+            }
+            else if (chainId === 57000) {
+                networkPrefix = 'ROLLUX-T'; // Rollux Testnet
+            }
+            else {
+                // Other EVM networks - use currency shortcut if available
+                if (currency) {
+                    // Check if it's a testnet network
+                    if (label.toLowerCase().includes('testnet') ||
+                        label.toLowerCase().includes('test')) {
+                        networkPrefix = `${currency.toUpperCase()}-T`;
+                    }
+                    else {
+                        networkPrefix = currency.toUpperCase();
+                    }
+                }
+                else {
+                    // Fallback to extracting meaningful prefix from label
+                    const firstWord = label.split(' ')[0];
+                    if (firstWord.toLowerCase().includes('testnet') ||
+                        firstWord.toLowerCase().includes('test')) {
+                        const baseWord = label.split(' ')[0];
+                        networkPrefix = `${baseWord.substring(0, 4).toUpperCase()}-T`;
+                    }
+                    else {
+                        networkPrefix =
+                            firstWord.length > 6
+                                ? firstWord.substring(0, 6).toUpperCase()
+                                : firstWord.toUpperCase();
+                    }
+                }
+            }
+        }
+        return `${networkPrefix} ${accountId + 1}`;
+    }
+    /**
+     * Clean up all resources
+     */
+    async destroy() {
+        this.lockWallet();
+        // Clear any remaining references
+        this.ethereumTransaction = {};
+        this.syscoinTransaction = {};
+    }
+}
+exports.KeyringManager = KeyringManager;
+//# sourceMappingURL=keyring-manager.js.map